Quantum 101

1. The “quantum apocalypse” and Shor's algorithm

A classical computer works with bits: each one is 0 or 1. A quantum computer works with qubits, which can sit in a combination of both until they are measured. It is not that they go “faster”: it is that they solve a certain class of problem by a route an ordinary computer does not have.

In 1994 the mathematician Peter Shor published an algorithm that does exactly what asymmetric cryptography assumes to be impossible: factor enormous numbers and solve discrete logarithms in reasonable time. Put another way, break RSA and ECC.

The word “break” is worth measuring carefully. It is not that they are weakened and the keys need lengthening. It is that the hard problem they rest on stops being hard. A longer key fixes nothing.

The other half of the story gets told far less, and it is reassuring. Against symmetric cryptography the best known quantum attack — Grover's algorithm — only manages to cut security in half. AES-128 falls short; AES-256 remains sufficient. The encryption of the bulk of the data does not fall.

So when does the machine arrive? It does not exist yet, and nobody serious puts a date on it. Today's quantum computers handle on the order of hundreds of noisy qubits, and breaking 2048-bit RSA would demand on the order of millions of physical qubits working with error correction. It is an unsolved engineering problem — which is not the same as an impossible one.

2. NIST final standards: FIPS 203/204/205 + HQC (2025)

If RSA and ECC fall, substitutes are needed: asymmetric algorithms resting on problems that are hard for a quantum computer too. That is post-quantum cryptography, and it needs no special hardware: it runs on ordinary computers.

In 2016 NIST — the United States standards institute — opened a public competition to choose them. Eight years of analysis and several candidates broken along the way later, in August 2024 it published the first three final standards.

FIPS 203 — ML-KEM, derived from CRYSTALS-Kyber. It is the replacement for key exchange: the mechanism by which two parties agree on a symmetric key without ever having told each other.

FIPS 204 — ML-DSA (CRYSTALS-Dilithium) and FIPS 205 — SLH-DSA (SPHINCS+). Both are for signing. Having two is not indecision: ML-DSA rests on lattices, the same as ML-KEM, whereas SLH-DSA rests on hash functions alone. Different mathematical assumptions, on purpose.

For that same reason, in March 2025 NIST selected HQC as a backup key-exchange mechanism, based on error-correcting codes rather than lattices; its standard is still being drafted. The intent is explicit: if a crack ever appears in lattices, everything should not fall at once.

Translated: the right answer to the quantum threat is not *an* algorithm, it is a portfolio of algorithms built on independent mathematics.

3. “Harvest now, decrypt later”: why to act today

There is a trap in reasoning about the quantum computer's date, and it is that the attacker does not need to have one to start.

The attack is called “harvest now, decrypt later” and it is as simple as it sounds: capture encrypted traffic today that cannot be read, store it, and decrypt it the day the machine exists. Storage is cheap and patience is free.

That changes the question entirely. It is not “when does the quantum computer arrive?” but how long does what I send today have to stay secret?

Michele Mosca framed it as an inequality you grasp at a glance: if the time your data must remain secret, plus the time it would take you to migrate your systems, is greater than the time left until the quantum computer, you are already late.

For this afternoon's chat message, it makes no difference. For a medical record, a contract, an identity file or a long-term signing key, it makes all the difference: those are data that still matter twenty years from now.

4. Xatoxi is not preparing for the future: it already lives there

The practical conclusion of all the above is an uncomfortable one: migrating to post-quantum cryptography is not a task for when the news breaks. It is a task for before it breaks.

Cuetum, Xatoxi's cryptographic layer, is aligned with NIST's final post-quantum standards — FIPS 203 — and with HQC, selected in 2025. It works with ML-KEM/Kyber, BIKE, FrodoKEM and HQC: exactly the portfolio of different assumptions the previous chapter talks about.

The network's secure channel performs key exchange on that basis and renews keys continuously (*forward secrecy*), so that compromising one key does not open the history.

And there is a detail that usually falls outside these conversations: where it runs. Xatoxi's decentralized plane is written in pure ANSI C, with no heavy dependencies, and that lets full post-quantum encryption work on a low-end phone. Protection that only reaches whoever owns an expensive device protects by halves.

Xatoxi is not preparing for the future: it already lives there.